About

Imported from CyberStrikeus/CyberStrike (.cyberstrike/skill/CIS_benchmarks/Operating_Systems/Ubuntu/cis-ubuntu-linux-18-04-lts-benchmark-v2/cis-ubuntu1804-v220-4-5-6/SKILL.md). Install upstream with npx skills add CyberStrikeus/CyberStrike --skill cis-ubuntu1804-v220-4-5-6. Copyright stays with the author.

CIS Ubuntu Linux 18.04 LTS Benchmark v2.2.0 - Control 4.5.6

Name: cis-ubuntu1804-v220-4-5-6
Author: CyberStrikeus

Profile Applicability

Level 2 - Server
Level 2 - Workstation

Description

/etc/shells is a text file which contains the full pathnames of valid login shells. This file is consulted by chsh and available to be queried by other programs.

Be aware that there are programs which consult this file to find out if a user is a normal user; for example, FTP daemons traditionally disallow access to users with shells not included in this file.

Rationale

A user can use chsh to change their configured shell.

If a user has a shell configured that isn't in in /etc/shells, then the system assumes that they're somehow restricted. In the case of chsh it means that the user cannot change that value.

Other programs might query that list and apply similar restrictions.

By putting nologin in /etc/shells, any user that has nologin as its shell is considered a full, unrestricted user. This is not the expected behavior for nologin.

Audit Procedure

Command Line

Run the following command to verify that nologin is not listed in the /etc/shells file:

grep '/nologin\b' /etc/shells

Expected Result

Nothing should be returned.

Remediation

Command Line

Edit /etc/shells and remove any lines that include nologin.

References

shells(5)
NIST SP 800-53 Rev. 5: CM-1, CM-2, CM-6, CM-7, IA-5

CIS Controls

v8 - 3.3 Configure Data Access Control Lists - Configure data access control lists based on a user's need to know.

v7 - 14.6 Protect Information through Access Control Lists.

Profile Applicability

Level 2 - Server
Level 2 - Workstation

Assessment Status

Automated

Use it

Copy one of these into your project. Installing also returns the manifest and these snippets.

yaml

targets:
  - https://api.opensmartroute.ai/api/v1/registry/cyberstrikeus-cyberstrike-cis-ubuntu1804-v220-4-5-6/manifest   # or paste the manifest below

Manifest

An Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.

cyberstrikeus-cyberstrike-cis-ubuntu1804-v220-4-5-6.ocm.jsonjson

{
  "ocm": "1",
  "id": "cyberstrikeus-cyberstrike-cis-ubuntu1804-v220-4-5-6",
  "kind": "skill",
  "name": "cis-ubuntu1804-v220-4-5-6",
  "description": "Ensure nologin is not listed in /etc/shells",
  "publisher": "CyberStrikeus",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "general"
    ],
    "tags": [
      "skill-md",
      "cis",
      "ubuntu",
      "linux",
      "ubuntu-18-04",
      "users",
      "account-security",
      "github"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "Ensure nologin is not listed in /etc/shells"
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "github",
      "repository": "https://github.com/CyberStrikeus/CyberStrike",
      "path": ".cyberstrike/skill/CIS_benchmarks/Operating_Systems/Ubuntu/cis-ubuntu-linux-18-04-lts-benchmark-v2/cis-ubuntu1804-v220-4-5-6/SKILL.md",
      "ref": "df28ccd3dc6d6c02391169121ee2dcdf4a6a132b",
      "url": "https://github.com/CyberStrikeus/CyberStrike/blob/df28ccd3dc6d6c02391169121ee2dcdf4a6a132b/.cyberstrike/skill/CIS_benchmarks/Operating_Systems/Ubuntu/cis-ubuntu-linux-18-04-lts-benchmark-v2/cis-ubuntu1804-v220-4-5-6/SKILL.md",
      "key": "CyberStrikeus/CyberStrike/.cyberstrike/skill/CIS_benchmarks/Operating_Systems/Ubuntu/cis-ubuntu-linux-18-04-lts-benchmark-v2/cis-ubuntu1804-v220-4-5-6/SKILL.md"
    }
  },
  "instructions": "# CIS Ubuntu Linux 18.04 LTS Benchmark v2.2.0 - Control 4.5.6\n\n## Profile Applicability\n\n- Level 2 - Server\n- Level 2 - Workstation\n\n## Description\n\n`/etc/shells` is a text file which contains the full pathnames of valid login shells. This file is consulted by `chsh` and available to be queried by other programs.\n\nBe aware that there are programs which consult this file to find out if a user is a normal user; for example, FTP daemons traditionally disallow access to users with shells not included in this file.\n\n## Rationale\n\nA user can use `chsh` to change their configured shell.\n\nIf a user ha",
  "cost": {
    "context_tokens": 431
  }
}

Fetch it by URL: GET /api/v1/registry/cyberstrikeus-cyberstrike-cis-ubuntu1804-v220-4-5-6/manifest?version=1.0.0

Reviews

Star ratings from people who tried it. One review per account; edit yours any time.

No reviews yet. Install it, try it, and be the first to rate it.